United States v. Levin

United States Court of Appeals
For the First Circuit

No. 16-1567

UNITED STATES OF AMERICA,

Appellant,

v.

ALEX LEVIN,

Defendant, Appellee.

APPEAL FROM THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MASSACHUSETTS

[Hon. William G. Young, U.S. District Judge]

Before
Torruella, Selya, and Lynch,
Circuit Judges.

Kelly Begg Lawrence, Assistant United States Attorney, with
whom Carmen M. Ortiz, United States Attorney, was on brief, for
appellant.
J. W. Carney, Jr., with whom Nathaniel Dolcort-Silver and
J. W. Carney, Jr. & Associates were on brief, for appellee.
Mark Rumold, with whom Andrew Crocker, Electronic Frontier
Foundation, Jessie J. Rossman and American Civil Liberties Union
of Massachusetts, were on brief, as amici curiae.
Caroline Wilson Palow, Scarlet Kim and Privacy International
on brief, as amici curiae.

October 27, 2017
 TORRUELLA, Circuit Judge. Central to this case is the

Federal Bureau of Investigation's ("FBI" or "government") use of

software that it terms a Network Investigative Technique ("NIT").

The FBI used the NIT pursuant to a warrant it obtained from a

magistrate judge in the Eastern District of Virginia (the "NIT

warrant"). The FBI installed the NIT on Playpen, a child

pornography website it had taken over and was operating out of

Virginia. The NIT attached itself to anything that was downloaded

from Playpen, and thus effectively travelled to the computers that

were downloading from the website, regardless of where those

computers were located. The NIT then caused those computers to

transmit several specific items of information -- which would allow

the FBI to locate the computers -- back to the FBI.

One computer the FBI located in this manner belonged to

Alex Levin of Norwood, Massachusetts. After a search of his

computer pursuant to a subsequent search warrant issued in

Massachusetts, the FBI found various media files allegedly

containing child pornography. Levin was indicted and charged with

one count of possession of child pornography, in violation of 18

U.S.C. § 2252A(a)(5)(B). Levin moved to suppress the evidence

seized pursuant to the NIT warrant and the warrant issued in

Massachusetts. The district court granted suppression, United

States v. Levin, 186 F. Supp. 3d 26, 44 (D. Mass. 2016), and the

-2-
government appealed. We disagree with the district court that

suppression is warranted, because the FBI acted in good faith

reliance on the NIT warrant. Accordingly, we vacate the district

court's suppression order and remand for further proceedings.1

I. Background

A. Playpen and the Dark Web

Child-pornography websites are a source of significant

social harm. "[T]he exploitive use of children in the production

of pornography" was already "a serious national problem" decades

ago. New York v. Ferber, 458 U.S. 747, 749 (1982). Modern

technology, which allows images and videos to be "traded with ease

on the [i]nternet," has only amplified the problem. Paroline v.

United States, 134 S. Ct. 1710, 1717 (2014). The child-pornography

website at the center of this case -- and several dozen other cases

throughout the nation2 -- bore the name "Playpen."

1 Recently, both the Eighth and Tenth Circuit reached similar
results in two cases involving the execution of the same NIT
warrant at issue in this appeal. See United States v. Horton, 863
F.3d 1041 (8th Cir. 2017) (reversing the district court's order
suppressing evidence obtained through the NIT warrant, pursuant
to the Leon good-faith exception, even though it determined that
the NIT was void ab initio because the magistrate judge exceeded
her jurisdiction under Rule 41(b)); United States v. Workman, 863
F.3d 1313 (10th Cir. 2017) (reversing the district court's order
suppressing evidence obtained through the NIT warrant, pursuant
to the Leon good-faith exception, without deciding if the
magistrate judge lacked the authority to issue the NIT warrant).
2 See, e.g., United States v. Taylor, No. 2:16-cr-00203-KOB-JEO-
1, 2017 WL 1437511, at *3-4 (N.D. Ala. Apr. 24, 2017) (collecting

-3-
 Playpen attracted web traffic on a massive scale. Just

between August 2014 and February 2015, more than 150,000 users

accessed the site. Visitors to Playpen made over 95,000 posts on

over 9,000 topics, all pertaining to child pornography. Playpen

also featured discussion forums where its users discussed issues

such as how to groom child victims and how to evade law

enforcement.

Playpen operated on the internet network known as Tor

(short for "The Onion Router"). This network, together with

similar networks, is known as the Dark Web. The United States

Naval Research Laboratory originally created Tor as a means of

protecting government communications. Today, however, the Tor

network is publicly accessible. One gains access to the Tor

network by downloading the Tor software. By masking its users'

actual IP addresses -- which could otherwise be used to identify

users -- that software offers its users much greater anonymity

than do conventional web browsers. Tor achieves this masking by

bouncing users' communications around a distributed network of

relay computers run by volunteers all around the world. The Tor

software can be used to access the conventional internet as well

as the Dark Web.

and categorizing cases).

-4-
 Websites on the Dark Web, known as hidden services, can

be reached only by using Tor software, or a similar software.

Playpen was one such hidden service. Unlike websites on the

conventional internet, hidden services cannot be accessed through

public search engines such as Google. Hidden services can be

accessed by using their addresses, if known to the person seeking

to access the hidden service, or by being redirected to them. The

latter can occur when, for instance, a link to a hidden service is

posted on another hidden service and a user clicks that link.

Because Playpen was a hidden service, a Playpen user had

to take several affirmative steps to access the site. First, he

or she needed to download and install the Tor software. Second,

the user would need to acquire the unique web address for Playpen.

Third, the user would use this address to find Playpen in the Tor

Network. And finally, he or she needed to enter a username and

password on Playpen's main page to access the site's content. The

main page displayed "two images depicting partially clothed

prepubescent females with their legs spread apart." Thus,

Playpen's subject matter was obvious even before the user logged

in and accessed the child-pornography content.

B. The Warrants and the NIT

In February 2015, FBI agents seized control of Playpen

pursuant to a warrant (which is not at issue in the present case).

-5-
After seizing control, the FBI continued to run Playpen out of a

government facility in the Eastern District of Virginia for two

weeks, with the purpose of identifying and apprehending Playpen

users.

On February 20, 2015, the government obtained the NIT

warrant from a magistrate judge in the Eastern District of

Virginia. This warrant permitted the FBI to install the NIT on

its server that hosted Playpen, and thereby to obtain information

from "[t]he activating computers [which] are those of any user or

administrator who logs into [Playpen] by entering a username and

password." The warrant authorized the FBI to obtain seven items

of information: (1) the activating computer's actual IP address,

and the date and time that the NIT determines what the IP address

is; (2) a unique identifier generated by the NIT (e.g., a series

of numbers, letters, and/or special characters) to distinguish

data from that of other activating computers, that will be sent

with and collected by the NIT; (3) the type of operating system

running on the computer, including type (e.g., Windows), version

(e.g., Windows 7), and architecture (e.g., x 86); (4) information

about whether the NIT has already been delivered to the activating

computer; (5) the activating computer's Host Name; (6) the

activating computer's active operating system username; and (7)

the activating computer's media access control ("MAC") address.

-6-
 After the NIT was installed on the government's server,

it worked in two steps. First, it augmented the content of the

website with additional computer instructions. Once a user or

administrator who had logged into Playpen downloaded such content,

he or she would also download those additional computer

instructions, which comprise the NIT. Then, the NIT would cause

the activating computer to transmit the seven pieces of

information, described above and authorized to be obtained by the

warrant, back to a computer controlled by the FBI. The NIT did

not deny the user of the activating computer access to any data or

functionality of its computer. The NIT allowed the FBI to identify

the IP addresses of hundreds of Playpen users around the country,

including in the Eastern District of Virginia.

Using the NIT, the government determined that a Playpen

user named "Manakaralupa" had accessed several images of child

pornography in early March 2015. The NIT caused Manakaralupa's

activating computer to transmit the aforementioned information to

the government. Using the seized information, the government

traced the IP address of that user to Levin's home address in

Norwood, Massachusetts.

On August 11, 2015, the government obtained a warrant

from a magistrate judge in the District of Massachusetts to search

Levin's home. The government executed the warrant the next day,

-7-
searched Levin's computer, and identified eight media files

allegedly containing child pornography.

On September 17, 2015, Levin was indicted and charged

with one count of possession of child pornography, in violation of

18 U.S.C. § 2252A(a)(5)(B). After Levin moved to suppress all

evidence seized pursuant to the NIT warrant and the warrant

authorizing the search of his home, the district court granted

Levin's motion on May 5, 2016. First, the district court found

that, since the warrant purported to authorize a search of property

located outside the federal judicial district where the issuing

judge sat, the NIT warrant was issued without jurisdiction and

thus was void ab initio. The court reasoned that the magistrate

judge was not authorized to issue it either under Rule 41 of the

Federal Rules of Criminal Procedure 3 or under the Federal

3 Rule 41 has been amended, apparently specifically to permit
magistrate judges to issue warrants such as the NIT warrant. It
now reads:

[A] magistrate judge with authority in any district
where activities related to a crime may have occurred
has authority to issue a warrant to use remote access
to search electronic storage media and to seize or
copy electronically stored information located within
or outside that district if: (A) the district where
the media or information is located has been concealed
through technological means . . . .

Fed. R. Crim. P. 41(b)(6).

Because this amendment became effective on December 1, 2016,
however, it does not apply to the present case. United States v.

-8-
Magistrates Act, 28 U.S.C. § 636(a).4

Second, the district court determined that suppression

was an appropriate remedy because the violation of Rule 41 was

substantive, rather than technical. The court reasoned that,

since the magistrate judge did not have jurisdiction to issue the

warrant, there was no judicial approval. According to the

district court, the resulting search was thus conducted as if not

pursuant to any warrant authorization, and was therefore

presumptively unreasonable.

The district court further concluded that, even if that

error were technical, suppression would still be appropriate, as

Levin demonstrated that he suffered prejudice. The court reasoned

that, had Rule 41(b) been followed, the magistrate judge would not

have issued the NIT warrant, and, therefore, the search conducted

pursuant thereto might not have occurred. Finally, the court

Walker-Couvertier, 860 F.3d 1, 9 (1st Cir. 2017).
4 Section 636(a) of the Federal Magistrates Act reads:

Each United States magistrate judge . . . shall have
within the district in which sessions are held by the
court that appointed the magistrate judge, at other
places where that court may function, and elsewhere
as authorized by law--(1) all powers and duties
conferred or imposed upon United States commissioners
by law or by the Rules of Criminal Procedure for the
United States District Courts . . . .

Id.

-9-
opined that the good-faith exception did not apply because the

search was conducted pursuant to a warrant that, in its view, was

void ab initio.

II. Discussion

"[W]hen considering a suppression ruling, we review

legal questions de novo and factual findings for clear error."

United States v. Ponzo, 853 F.3d 558, 572 (1st Cir. 2017). We

disagree with the district court's ruling suppressing the evidence

seized pursuant to the NIT warrant. Regardless of whether a Fourth

Amendment violation occurred, the facts of this case show that the

Leon good-faith exception applies.

"The Fourth Amendment contains no provision expressly

precluding the use of evidence obtained in violation" of its terms.

United States v. Leon, 468 U.S. 897, 906 (1984). Nevertheless,

the Supreme Court created the exclusionary rule as a "'prudential'

doctrine . . . 'to compel respect for the constitutional

guaranty.'" Davis v. United States, 564 U.S. 229, 236 (2011)

(first quoting Pa. Bd. of Prob. & Parole v. Scott, 524 U.S. 357,

363 (1998); and then quoting Elkins v. United States, 364 U.S.

206, 217 (1960)). The exclusion of evidence obtained by an

unconstitutional search is "not a personal constitutional right"

but a remedy whose "sole purpose . . . is to deter future Fourth

-10-
Amendment violations." Id. at 236-37 (quoting Stone v. Powell, 428

U.S. 465, 486 (1976)).

Under the exclusionary rule, courts may suppress

evidence "obtained as a direct result of an illegal search or

seizure" as well as evidence that is the "fruit of the poisonous

tree." Utah v. Strieff, 136 S. Ct. 2056, 2061 (2016) (quoting

Segura v. United States, 468 U.S. 796, 804 (1984)). However, due

to the significant costs of suppressing evidence of crimes, the

exclusionary rule applies "only . . . where its deterrence benefits

outweigh its substantial social costs." Id. (quoting Hudson v.

Michigan, 547 U.S. 586, 591 (2006)) (alteration in original).

"[T]he deterrence benefits of exclusion 'var[y] with the

culpability of the law enforcement conduct' at issue. When the

police exhibit 'deliberate,' 'reckless,' or 'grossly negligent'

disregard for Fourth Amendment rights, the deterrent value of

exclusion is strong and tends to outweigh the resulting costs."

Davis, 564 U.S. at 238 (quoting Herring v. United States, 555 U.S.

135, 143-44 (2009) (second alteration in original). However,

"when the police act with an objectively reasonable good-faith

belief that their conduct is lawful . . . or when their conduct

involves only simple, isolated negligence . . . the deterrence

rationale loses much of its force, and exclusion cannot pay its

way." Id. (internal citations and quotation marks omitted).

-11-
 The Supreme Court has clearly delineated the bounds of

the good faith exception. Suppression remains appropriate:

1. "[I]f the magistrate or judge in issuing a
warrant was misled by information in an affidavit that
the affiant knew was false or would have known was
false except for his reckless disregard of the truth."
2. "[W]here the issuing magistrate wholly
abandoned his judicial role."
3. Where the executing officer relies "on a
warrant based on an affidavit 'so lacking in indicia
of probable cause as to render official belief in its
existence entirely unreasonable.'"

Leon, 468 U.S. at 923 (citations omitted).

Furthermore, "[t]he Leon good faith exception does not

apply where . . . a warrant . . . is 'so facially deficient--i.e.

in failing to particularize the place to be searched or the things

to be seized--that the executing officers cannot reasonably

presume it to be valid.'" United States v. Woodbury, 511 F.3d 93,

99 (1st Cir. 2007) (citing United States v. Owens, 167 F.3d 739,

475 (1st Cir. 1999)).

Finally, in determining whether a reasonable officer

should have known that a search was illegal despite a magistrate's

authorization, "a court must evaluate all the attendant

circumstances, keeping in mind that Leon requires . . . objective

good faith." United States v. Ricciardelli, 998 F.2d 8, 15 (1st

Cir. 1993) (internal citations omitted).

None of the four conditions identified by Leon apply.

Levin argues that the NIT warrant was akin to a general warrant

-12-
and therefore so obviously lacking in particularity that the

officers' reliance on it amounted to bad faith. See United States

v. Ninety-Two Thousand Four Hundred Twenty-Two Dollars & Fifty-

Seven Cents, 307 F.3d 137, 149 (3d Cir. 2002) (Alito, J.)

(distinguishing between an "overly broad" warrant, under which

evidence "need not be suppressed if the good faith exception

applies," and a warrant that is so "general" that "executing

officers could not have reasonably trusted in its legality"). A

plain reading of the NIT warrant, however, shows otherwise. "The

general warrant specified only an offense . . . and left to the

discretion of the executing officials the decision as to which

persons should be arrested and which places should be searched."

Steagald v. United States, 451 U.S. 204, 220 (1981). In the case

at hand, in contrast, the NIT warrant did not leave to the

discretion of the executing officials which places should be

searched, because the NIT warrant clearly specifies that only

activating computers -- that is "those of any user . . . who logs

into [Playpen] by entering a username and password" -- are to be

searched. The NIT warrant specifies into which homes an intrusion

is permitted (those where the activating computers are located),

and on what basis (that the users in those homes logged into

Playpen). And if the government wished to conduct any further

searches of anyone's home, it would have needed obtain an

-13-
additional warrant -- which is exactly what it did in this case.

Therefore, the NIT warrant "was not so facially deficient that the

executing officers could not reasonably have presumed it to be

valid." Woodbury, 511 F.3d at 100.

We are unpersuaded by Levin's argument that because, at

least according to him, the government was not sure whether the

NIT warrant could validly issue under Rule 41, there is government

conduct here to deter. Faced with the novel question of whether

an NIT warrant can issue -- for which there was no precedent on

point -- the government turned to the courts for guidance. The

government presented the magistrate judge with a request for a

warrant, containing a detailed affidavit from an experienced

officer, describing in detail its investigation, including how the

NIT works, which places were to be searched, and which information

was to be seized.5 We see no benefit in deterring such conduct

-- if anything, such conduct should be encouraged, because it

leaves it to the courts to resolve novel legal issues.6

5 Although Levin protests that the warrant failed to describe the
activating computers as the places to be searched, the request for
a warrant in fact, under the heading "Place to be Searched," states
that the NIT will obtain "information . . . from the activating
computers described below." The request for the warrant goes on
to explain that "[t]he activating computers are those of any user
or administrator who logs into [Playpen] by entering a username
and password."
6 This situation is, of course, distinct from one in which the
government would request and somehow obtain a warrant for conduct

-14-
 Thus, we are unpersuaded that there was any bad faith on

the part of the executing officers. The officers acted pursuant

to the warrant. To the extent that a mistake was made in issuing

the warrant, it was made by the magistrate judge, not by the

executing officers, and the executing officers had no reason to

suppose that a mistake had been made and the warrant was invalid.

As discussed above, the NIT warrant was not written in general

terms that would have signaled to a reasonable officer that

something was amiss. The warrant in this case was particular

enough to infer that, in executing it, "the [executing officers]

act[ed] with an objectively 'reasonable good-faith belief' that

their conduct [was] lawful." Davis, 564 U.S. at 238. Under these

circumstances, "the 'deterrence rationale loses much of its

force,' and exclusion cannot 'pay its way.'" Id. (internal

citations omitted).7

Therefore, because the government acted in good faith

reliance on the NIT warrant, and because the deterrent effects on

law enforcement do not outweigh the great cost to society of

suppressing the resulting evidence, suppression is not warranted.

it knows to be illegal.
7 Any deterrent effect is further limited by the fact that Rule
41 has been amended and now appears to allow a magistrate to issue
NIT warrants such as the one at issue here. See supra note 3.

-15-
 III. Conclusion

The district court erred in granting the motion to

suppress. Because the executing officers acted in good faith

reliance on the NIT warrant, the Leon exception applies.

Accordingly, the district court's order is vacated, and the case

is remanded for further proceedings not inconsistent with this

opinion.

Vacated and Remanded.

-16-